The password is a sensitive personal information which renders centralized plaintext training ethically and legally untenable under prevailing regulations. Existing privacy-preserving techniques (e.g., federated learning, homomorphic encryption) are characterised by computational overhead, performance degradation, and inadequate task-specific optimisation for password data. To address these limitations, a privacy-preserving multi-task password guessing framework, termed P³G, is proposed. The model under consideration adopts a shared-private architecture with three tailored innovations. Firstly, a Structure-Aware Differential Privacy (SADP) mechanism is designed which injects Gaussian noise modulated by password character type and network depth to preserve semantic consistency. Furthermore, a Complexity-Aware Curriculum Learning (CACL) mechanism is proposed to be adopted as a guiding principle for training, with the objective of transitioning from simple to complex passwords via entropy-based temperature scheduling. Finally, Strength-Aware Task Weighting (SATW) mechanism is a dynamic balancing of tasks using password strength metrics. Experiments on real-world datasets (CSDN, RockYou, 000webhost) demonstrate that P³G reduces perplexity by 7.36 percent for generative password guessing and improves masked recovery accuracy by 3.07 percent. Furthermore, it achieves a 26.06 percent lower task conflict (TC) and a privacy leakage index (PLI) of only 0.093. To the best of our knowledge, this is the first work to tailor privacy mechanisms explicitly for multi-task password modeling, offering a new perspective for password research.

The composition of the password is markedly disparate contingent on the configuration strategy and the individual user's predilections. The objective of this paper is to mine the region attribute information behind the password text through text classification. In contrast to the traditional text classification approach, the classification of password region attribution represents a distinct challenge namely ultra-short text classification. The issue of password regional attribute classification is particularly tricky due to its inherent lexical polysemy, the scarcity of text features, the lack of context and the difficulty in explicitly identifying semantics. To address the aforementioned issues, we propose a multi-granularity cascade fusion approach for password region attribution classification. Firstly, the model employs series of segmentation techniques to split password into multi-dimensional fine-grained subword representations. Subsequently, multiple segmented representations of the same password are fed into a localised feature encoder to mine the private local features. Finally, a multi-level cascade fusion method is designed to integrate different granularity of password features into a unified representation to classification. Our approach can effectively addresses the limitations of scarce information and the challenge of integrating multiple representations for password text. Experiments on a large amount of real password data demonstrate that, our model can converge rapidly and achieve an accuracy of 88.18%, a precision of 88.31%, a recall of 87.73%, and an F1-score of 88.02%, significantly outperforming traditional models.

Shadowsocks(R) is a proxy software based on Socks5, which is the collective name of shadowsocks and shadowsocksR. Shadowsocks(R) is a private protocol without a handshake negotiation mechanism. Peng broke the confidentiality of shadowsocks by exploiting vulnerability in the shadowsocks protocol and decrypted the shadowsocks packets encrypted with none-AEAD encryption options using a redirection attack. Chen et al. started with the cryptographic algorithm used by shadowsocks(R) and preliminarily discussed the confidentiality of user data under the protection of shadowsocks(R) in theory. Based on Chen’s work, this paper further clarifies the shadowsocks(R) protocol format and studies the encryption mechanism of shadowsocks(R) from the perspective of protocol analysis. The vulnerability of the shadowsocks(R) encryption mechanism is found, and an attack method of shadowsocks(R) is proposed. The attack method is a passive attack and can decrypt the shadowsocks packets encrypted with any encryption option. Compared with Peng’s attack method, the method is more effective and more suitable for actual attacks. Finally, some methods to improve the protocol security of shadowsocks(R) are proposed.